in reply to Protecting passwords in source

Your gut probably tells you that putting passwords in code is wrong. Well, it is. Actually storing passwords in plain text in any way (code, text files, databases, etc...) is ALWAYS a bad thing. Notice that I rarely use the word always =)

Actually we usually don't put passwords in code. I (and this is only me, maybe - probably- someone does it better) do it like this:

1) In the page that register users I turn the password into a md5 hash and store it in a db.

2) In the login page, I get the user-typed password, make it into a md5 hash and then compare with the one in the db.

Anyway, forget about the md5 part - there are tons of encrypting algorythms out there - but it's everything else that matters, meaning:

1 - Don't EVER store passwords in plain text.
2 - Don't put it in the code, store in a separate way.


Replies are listed 'Best First'.
Re^2: Protecting passwords in source
by zshzn (Hermit) on Jul 20, 2005 at 03:39 UTC
    Ultimately a one-way hash is a good choice. Store your password as a hashed string. Hash the password the user inputs and compare it with the hash of your required password. You can use Digest::MD5 or something else if you'd like. Either way your password isn't visable in the source and is not reversable.

    However, as pointed out above, if everyone else has advanced privileges on the system they can just copy your program and change the hash, or change any part of the program to allow them access. So it is seemingly futile.